The reward in a typical botnet evasion generation model using a DRL black-box attack is the output of the botnet detector [1]}, [2]}, which can be a real number in the range of [0, 1]. In our case, for the botnet sample, the expected value is '0', and for a normal traffic sample, the output should be ideally '1'. Hence for a botnet sample to be considered a successful evasion by a DRL attacker, we set the threshold for the reward to be greater than 0.5. In other terms, if the sample generated by the DRL attacker is evaded with more than 50% confidence, the reward will be '1' and '0' otherwise.
